I have one more question: when Bro detected a Stepping Stone , it show us a
time. Is the time
when Bro see a packet belong to the Chain?
It's the time when Bro's algorithm has determined that a stepping stone exists.
You could follow the logic in stepping.bro regarding when it generates this
output in order to determine this.
Vern